CVE-2026-49235
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jun 8, 2026
CISA due date
—
The record
When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | routinator | 0 | 0.15.2 |
Related vulnerabilities
- GHSA-5qf9-cf9c-hjc6 Routinator crashes when encountering maliciously crafted RRDP XML files Same vulnerability
- GHSA-33mj-99mg-8g73 Routinator has cache path traversal when processing the module component of rsync URIs Also affects routinator
- GHSA-gc6q-cwcj-3vh9 Routinator crashes when sending a maliciously crafted select-asn query parameter Also affects routinator
- CVE-2026-49234 When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the… Also affects routinator
- CVE-2026-49233 Routinator does not properly check the module component of rsync URIs, which are used to… Also affects routinator
- CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-755
- CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-755
- CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-755